Looks like this returns some results inurl:.git "intitle:index.of
One in every 600 websites has .git exposed
71–80 of 214 posts
Re: One in every 600 websites has .git exposed
#72Not going to name names, but there are mobile apps have their .git packaged up with them too.
Re: One in every 600 websites has .git exposed
#73Earlier quoted context omitted.
Wrong lesson. Don't put secret keys in your repository. Someone getting a copy of your code should be a big annoyance at worst.
Where is the right place to store db passwords, api keys, etc? What is best practice in this area?
Environment variables are the best and easiest way that I know of. You can supply those anyway you want to, and any programming language can easily get their values.
Re: One in every 600 websites has .git exposed
#74Earlier quoted context omitted.
Where is the right place to store db passwords, api keys, etc? What is best practice in this area?
In a configuration file that is not version controlled, or even environment variables, so that your application starts with the right variables, but they are not in some config file.
How do you communicate that data amongst team members then?
Re: One in every 600 websites has .git exposed
#75Earlier quoted context omitted.
Wrong lesson. Don't put secret keys in your repository. Someone getting a copy of your code should be a big annoyance at worst.
Where is the right place to store db passwords, api keys, etc? What is best practice in this area?
FWIW I have a /private directory in the root of all vhosts, so it looks like:
/srv/www/domain.com/public_html/
|--------->/private/
|--------->/logs/
|--------->/tmp/
It's specifically for storing things like configuration files.
I think this should be standard practice.
Re: One in every 600 websites has .git exposed
#76For Apache, Order deny,allow Deny from all Order allow,deny Deny from all https://serverfault.com/questions/128069/how-do-i-prevent-ap...
Better yet: $ rm -rf .git/ It's way safer to delete the repo history from the production server than to rely on Apache rules copied from a forum.
Better better yet, don't use git to move code from test to prod. Use rsync, and exclude .git and other nuisance files.
Unfortunately I can't seem to convince anyone that this is good practice. :-(
Re: One in every 600 websites has .git exposed
#77There are configs within nginx that prevent this from happening. Also, I symlink only the publicfiles from a different directory into my /var/www/html folder.
Re: One in every 600 websites has .git exposed
#7890% of security incidents are due to human errors, not to some secretive hacker group spending $10m to crack TLS.
Doing system administration right (eg. no secrets in repos) has a lot more impact on security than implementing all the other complex controls.
Of course, doing everything is much better.
Re: One in every 600 websites has .git exposed
#79Earlier quoted context omitted.
Where is the right place to store db passwords, api keys, etc? What is best practice in this area?
FWIW I have a /private directory in the root of all vhosts, so it looks like: /srv/www/domain.com/public_html/ |--------->/private/ |--------->/logs/ |--------->/tmp/ Anything stored in /private/ is not publicly accessible by the web server process, but can be read or written by anything running under the user's username. It's specifically for storing things like configuration files. I think this should be standard p…
Thanks for the tip. How do you keep passwords and keys in sync amongst team members safely?
Re: One in every 600 websites has .git exposed
#80Earlier quoted context omitted.
[deleted]
Best thing for nginx is do an include in each server {} block. # /etc/nginx/deny-dot-files.conf location ~ /\. { access_log off; log_not_found off; deny all; } server { include /etc/nginx/deny-dot-files.conf; }
Is there no way to set that universally in nginx?